CVE-2026-53901: Cerebrate before v1.37 allows mass assignment of record identifiers during object creation

Synopsis

A mass-assignment vulnerability in Cerebrate, the open-source threat intelligence sharing platform, allows an unauthenticated network attacker to supply attacker-chosen record identifiers during object creation via the generic CRUD add endpoint. The flaw is reachable over the network with no authentication required, because the add() handler failed to strip the id field after input normalization, letting an attacker-controlled value survive into the entity creation path. Successful exploitation allows an attacker to create objects with arbitrary identifiers, enabling data tampering, object spoofing, inconsistent cross-references, or identifier collision attacks. A patched-image rebuild at v1.37 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable add endpoint is exposed over the network, so an attacker must be able to reach the Cerebrate service via HTTP/HTTPS.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no account or session credential is needed to send a crafted request to the affected endpoint.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is straightforward and reliable with no race conditions or special environmental conditions required.

Blast Radius

• An attacker writes objects into the Cerebrate database with hand-picked identifiers, overriding server-controlled sequencing.
• Attacker-chosen identifiers can collide with or shadow existing legitimate records, corrupting cross-references between Cerebrate objects such as organisations, sharing groups, or contacts.
• Spoofed identifiers can cause downstream systems that trust Cerebrate's identifier space to ingest or act on falsified object relationships.
• Secondary integrity impact in connected scopes (SI:L) means linked or federated Cerebrate nodes may also reflect the tampered identifier data.